Analysis
-
max time kernel
60s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:58
Static task
static1
Behavioral task
behavioral1
Sample
e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe
Resource
win10v2004-20230220-en
General
-
Target
e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe
-
Size
522KB
-
MD5
1c1b97e3fc4ebc7d8ceb6f0a5123de20
-
SHA1
97e35ba7f1a99b062f9abfc3877193a81e283bba
-
SHA256
e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c
-
SHA512
a5da1dc88dba0cc2a6be977e9292c359752bd9811a1719f926044671f345de56ed8ffc4106dea2dc18dbd9b1d6b3141cd689128861a0c6a7d918f7685fcaeb74
-
SSDEEP
12288:2Mrwy90Fg++ICy8M7RGMF7OtFqJtvU5JNJsGzYTcYY:2yF+7CWR9F7uEtvIJsGzYcF
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
jr143656.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr143656.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr143656.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr143656.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr143656.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr143656.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr143656.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/112-156-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-157-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-159-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-161-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-163-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-165-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-169-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-167-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-171-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-173-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-175-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-176-0x0000000004C80000-0x0000000004C90000-memory.dmp family_redline behavioral1/memory/112-179-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-181-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-185-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-183-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-187-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-189-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-191-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-193-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-195-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-197-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-199-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-201-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-203-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-205-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-207-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-209-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-211-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-213-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-215-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-217-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-219-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/112-221-0x0000000002530000-0x000000000256F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zirR8295.exejr143656.exeku181427.exelr656291.exepid process 372 zirR8295.exe 1524 jr143656.exe 112 ku181427.exe 2740 lr656291.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr143656.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr143656.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zirR8295.exee473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zirR8295.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirR8295.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 112 WerFault.exe ku181427.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr143656.exeku181427.exelr656291.exepid process 1524 jr143656.exe 1524 jr143656.exe 112 ku181427.exe 112 ku181427.exe 2740 lr656291.exe 2740 lr656291.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr143656.exeku181427.exelr656291.exedescription pid process Token: SeDebugPrivilege 1524 jr143656.exe Token: SeDebugPrivilege 112 ku181427.exe Token: SeDebugPrivilege 2740 lr656291.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exezirR8295.exedescription pid process target process PID 3240 wrote to memory of 372 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe zirR8295.exe PID 3240 wrote to memory of 372 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe zirR8295.exe PID 3240 wrote to memory of 372 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe zirR8295.exe PID 372 wrote to memory of 1524 372 zirR8295.exe jr143656.exe PID 372 wrote to memory of 1524 372 zirR8295.exe jr143656.exe PID 372 wrote to memory of 112 372 zirR8295.exe ku181427.exe PID 372 wrote to memory of 112 372 zirR8295.exe ku181427.exe PID 372 wrote to memory of 112 372 zirR8295.exe ku181427.exe PID 3240 wrote to memory of 2740 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe lr656291.exe PID 3240 wrote to memory of 2740 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe lr656291.exe PID 3240 wrote to memory of 2740 3240 e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe lr656291.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe"C:\Users\Admin\AppData\Local\Temp\e473e39e9b1a701150bc531c8343a891deb5ec97e10c9181ced7b2946777cd6c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirR8295.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirR8295.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr143656.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr143656.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181427.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181427.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 18604⤵
- Program crash
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr656291.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr656291.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 112 -ip 1121⤵PID:4900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr656291.exeFilesize
175KB
MD5db64b9a1ff016184f1db016ccb50ba53
SHA1073cb8402cdd0b02d695f51d8f0b007959bcb3ac
SHA2568b1deb1f63a7bb591833fd6af127b924f7bc97bd885d7b290fb1a3519b88c39d
SHA512b58d1e9a92009bb49375df6d95943172183ba80f2b9164e5399bdbabc1f9b8a1edeef4ecd36e6b191d909d9691b7ddbda4ff368a129e7d26da6ce84784a8d50e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr656291.exeFilesize
175KB
MD5db64b9a1ff016184f1db016ccb50ba53
SHA1073cb8402cdd0b02d695f51d8f0b007959bcb3ac
SHA2568b1deb1f63a7bb591833fd6af127b924f7bc97bd885d7b290fb1a3519b88c39d
SHA512b58d1e9a92009bb49375df6d95943172183ba80f2b9164e5399bdbabc1f9b8a1edeef4ecd36e6b191d909d9691b7ddbda4ff368a129e7d26da6ce84784a8d50e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirR8295.exeFilesize
379KB
MD5c98d4fb86e16871a0747bc15bea463ea
SHA1ba2fe5d66ba7aed0dca6f22735375b24ca8c022b
SHA25619e9a1cb57a7531535ca7868cfe62236a0837bb1fc4c26d81eba28ef6d9f2e32
SHA51222cd6529cba4c3a626df2814cc634eb228a5bc2261a2dfea8bfc690596f3f0449a38fdc0faeabe3b11ac6053e2c7930a30d84e05b07c6426a18e05c566880011
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zirR8295.exeFilesize
379KB
MD5c98d4fb86e16871a0747bc15bea463ea
SHA1ba2fe5d66ba7aed0dca6f22735375b24ca8c022b
SHA25619e9a1cb57a7531535ca7868cfe62236a0837bb1fc4c26d81eba28ef6d9f2e32
SHA51222cd6529cba4c3a626df2814cc634eb228a5bc2261a2dfea8bfc690596f3f0449a38fdc0faeabe3b11ac6053e2c7930a30d84e05b07c6426a18e05c566880011
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr143656.exeFilesize
11KB
MD562333705c6e94740ed1ea6373b5d044d
SHA105e1892ad2bf472902b3a5491781c19fdbbd8177
SHA256d41e4af4a3e4f45c734298ebe777ead8dcadfd1fb18717b3251117bbd5dafd47
SHA512e21d711a22edf987c6ffe04fba89aa3a1d6d18aec4a8e12db8724627ba9e6ca3cfb5ffed3f552523039785fecab8ac3235d5f1acc97f0b64b7cbbd0c946b747e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr143656.exeFilesize
11KB
MD562333705c6e94740ed1ea6373b5d044d
SHA105e1892ad2bf472902b3a5491781c19fdbbd8177
SHA256d41e4af4a3e4f45c734298ebe777ead8dcadfd1fb18717b3251117bbd5dafd47
SHA512e21d711a22edf987c6ffe04fba89aa3a1d6d18aec4a8e12db8724627ba9e6ca3cfb5ffed3f552523039785fecab8ac3235d5f1acc97f0b64b7cbbd0c946b747e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181427.exeFilesize
294KB
MD570aadd4b26bd2bfe5e36a15436c10e81
SHA13533970f0765bf5309dc801f7bea01417ccfadab
SHA25653cf8cf0b6c9a07e93d4ce0eaa5ea6e2cad342b515453eed49d8412e319e996f
SHA5122048cd9905938029a8a3f0e590b2d79df9f4bdc58d26824d40b2dc0da7ddb658bd9a9bdd080e6112e6d07f3bf136cd9dea4db290be95ecca214385b09a17e1cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku181427.exeFilesize
294KB
MD570aadd4b26bd2bfe5e36a15436c10e81
SHA13533970f0765bf5309dc801f7bea01417ccfadab
SHA25653cf8cf0b6c9a07e93d4ce0eaa5ea6e2cad342b515453eed49d8412e319e996f
SHA5122048cd9905938029a8a3f0e590b2d79df9f4bdc58d26824d40b2dc0da7ddb658bd9a9bdd080e6112e6d07f3bf136cd9dea4db290be95ecca214385b09a17e1cd
-
memory/112-153-0x0000000000620000-0x000000000066B000-memory.dmpFilesize
300KB
-
memory/112-154-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-155-0x0000000004C90000-0x0000000005234000-memory.dmpFilesize
5.6MB
-
memory/112-156-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-157-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-159-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-161-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-163-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-165-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-169-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-167-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-171-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-173-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-175-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-176-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-177-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-179-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-181-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-185-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-183-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-187-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-189-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-191-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-193-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-195-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-197-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-199-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-201-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-203-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-205-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-207-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-209-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-211-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-213-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-215-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-217-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-219-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-221-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/112-1064-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/112-1065-0x0000000005860000-0x000000000596A000-memory.dmpFilesize
1.0MB
-
memory/112-1066-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/112-1067-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/112-1068-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-1070-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-1071-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/112-1073-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-1072-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/112-1074-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/112-1075-0x0000000006370000-0x0000000006532000-memory.dmpFilesize
1.8MB
-
memory/112-1076-0x0000000006540000-0x0000000006A6C000-memory.dmpFilesize
5.2MB
-
memory/112-1077-0x0000000006CD0000-0x0000000006D46000-memory.dmpFilesize
472KB
-
memory/112-1078-0x0000000006D70000-0x0000000006DC0000-memory.dmpFilesize
320KB
-
memory/112-1079-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/1524-147-0x0000000000A50000-0x0000000000A5A000-memory.dmpFilesize
40KB
-
memory/2740-1085-0x0000000000E20000-0x0000000000E52000-memory.dmpFilesize
200KB
-
memory/2740-1086-0x0000000005690000-0x00000000056A0000-memory.dmpFilesize
64KB